CVE-2026-70441

The CVSS 5.4 score on this stored XSS in the Jenkins Summary Display Plugin fundamentally misrepresents the actual risk in CI/CD environments. The vulnerability lives in how job names render in build report pages without escaping, and the permission model treats Item/Create as a meaningful access gate — but in Jenkins, pipelines satisfy that gate automatically as a core function, not as an exploitation step. When a pipeline parses a branch name, commit hash, or webhook payload into a job identifier — an architecturally encouraged practice in Jenkinsfiles — it is exercising Item/Create-equivalent operations programmatically. A compromised shared library, a weaponized webhook, or a supply chain payload can inject weaponized job names that persist in build history indefinitely. Every subsequent build report page renders that payload for every developer, release engineer, or security tool that views it. The compounding factor: the session context being harvested is not a low-privilege user. Developers and release engineers viewing build reports are typically among the most privileged accounts in a Jenkins environment — often with credentials capable of pushing to production. The stored XSS doesn't need to be targeted or clever; it just needs to capture the session of anyone who opens the build report. And in most deployments, that session can reach credential stores, deployment targets, and configuration state that far exceeds what CVSS 'medium severity' implies. The EPSS score of 0.00114 reflects manual exploitability assumptions — form-based injection requiring a human attacker. But automated systems already have Item/Create permissions. The stored nature means a single compromised component retroactively infects all downstream build reports. This isn't a vulnerability that waits for manual exploitation; it's a persistent lens that photographs every privileged session that passes through it. Prioritize patching the Summary Display Plugin to the latest version. Treat any job name derived from external input (branch names, webhook data, third-party integrations) as potentially weaponized. Audit shared libraries and pipeline configurations for compromise. The CVSS score is a historical artifact from a threat model that assumed 'authenticated user' meant a human with a browser — not a pipeline with execution context.

Reviewed through automated stages and approved by a human before publication.